supabase-supabase-js-2.x-lockfile/backend/.env.example

# Application settings
APP_NAME="Another Nuzlocke Tracker API"
DEBUG=true

# API settings
API_V1_PREFIX="/api/v1"

# Database settings
DATABASE_URL="sqlite:///./nuzlocke.db"

# Supabase Auth (JWKS used for JWT verification)
SUPABASE_URL=https://your-project.supabase.co
SUPABASE_ANON_KEY=your-anon-key
# HS256 fallback for local GoTrue (not needed for Supabase Cloud):
# SUPABASE_JWT_SECRET=super-secret-jwt-token-with-at-least-32-characters-long
Initial setup of frontend and backend 2026-02-04 17:13:58 +01:00			`# Application settings`
Rebrand to Another Nuzlocke Tracker (ANT) (#27) Co-authored-by: Julian Tabel <juliantabel.jt@gmail.com> Co-committed-by: Julian Tabel <juliantabel.jt@gmail.com> 2026-02-17 20:17:07 +01:00			`APP_NAME="Another Nuzlocke Tracker API"`
Initial setup of frontend and backend 2026-02-04 17:13:58 +01:00			`DEBUG=true`

			`# API settings`
			`API_V1_PREFIX="/api/v1"`

			`# Database settings`
			`DATABASE_URL="sqlite:///./nuzlocke.db"`
feat: add auth system, boss pokemon details, moves/abilities API, and run ownership Add user authentication with login/signup/protected routes, boss pokemon detail fields and result team tracking, moves and abilities selector components and API, run ownership and visibility controls, and various UI improvements across encounters, run list, and journal pages. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> 2026-03-20 21:41:38 +01:00
feat: migrate JWT verification from HS256 shared secret to JWKS Replace symmetric HS256 JWT verification with asymmetric RS256 using JWKS. Backend now fetches and caches public keys from Supabase's JWKS endpoint instead of using a shared secret. - Add cryptography dependency for RS256 support - Use PyJWKClient to fetch/cache JWKS from {SUPABASE_URL}/.well-known/jwks.json - Remove SUPABASE_JWT_SECRET from config, docker-compose, deploy workflow, .env - Update tests to use RS256 tokens with mocked JWKS client Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> 2026-03-21 14:01:31 +01:00			`# Supabase Auth (JWKS used for JWT verification)`
feat: add auth system, boss pokemon details, moves/abilities API, and run ownership Add user authentication with login/signup/protected routes, boss pokemon detail fields and result team tracking, moves and abilities selector components and API, run ownership and visibility controls, and various UI improvements across encounters, run list, and journal pages. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> 2026-03-20 21:41:38 +01:00			`SUPABASE_URL=https://your-project.supabase.co`
			`SUPABASE_ANON_KEY=your-anon-key`
fix: add HS256 fallback for JWT verification in local dev Local GoTrue signs JWTs with HS256, but the JWKS endpoint returns an empty key set since there are no RSA keys. Fall back to HS256 shared secret verification when JWKS fails, using SUPABASE_JWT_SECRET. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> 2026-03-22 09:38:52 +01:00			`# HS256 fallback for local GoTrue (not needed for Supabase Cloud):`
			`# SUPABASE_JWT_SECRET=super-secret-jwt-token-with-at-least-32-characters-long`